Apache Qpid Proton C versions through 0.40.0 have a vulnerability in the SASL authentication frame dispatching process. The software incorrectly dispatches AMQP frames that claim to be SASL frames, allowing an authentication bypass. However, no user name is set during this bypass, so the impact depends on how the application handles an unauthenticated state. The issue is fixed in version 0.41.1.